NetSight
IP …
medium5.5

CVE-2019-7665

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf.

Impact

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

Affected products

VendorProductAffected versions
Elfutils ProjectElfutils
Version 0.175
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 18.10
OpensuseLeap
Versions 15.0, 15.1
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Versions 8.1, 8.2, 8.4
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 8.2, 8.4
RedhatEnterprise Linux Server Tus
Versions 8.2, 8.4
RedhatEnterprise Linux Workstation
Version 7.0

Weakness classification

CWE-125

References